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We propose a decoy-state method to overcome the photon- 
number-splitting attack for Bennett-Brassard 1984 quantum 
key distribution protocol in the presence of high loss: A legit- 
imate user intentionally and randomly replaces signal pulses 
by multi-photon pulses (decoy-states) . Then they check the 
loss of the decoy-states. If the loss of the decoy-states is ab- 
normally less than that of signal pulses, the whole protocol is 
aborted. Otherwise, to continue the protocol, they estimate 
loss of signal multi-photon pulses based on that of decoy- 
states. This estimation can be done with an assumption that 
the two losses have similar vàlues, that we justify. 
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Information processing with quantum systems enables 
ccrtain tasks that seems to be impossible with its classi- 
cal counterparts, e.g. quantum cryptography [1-4], quan- 
tum computation [5], and quantum metrologies [6-9]. In 
addition to the practical importance, this fact has large 
theoretical and even philosophical implications. 

Bennett-Brassard 1984 (BB84) Quantum key distribu- 
tion (QKD) protocol [2,10] is one of the most promising 
quantum information processing. It is expected that it 
will be the first practical quantum information processor 
[10]. 

Howcvcr, a bottleneck in practical realization of QKD 
for global secure Communications is distance-limit: Im- 
plementation of QKD has been successful at order of 
tens-kilometers [10]. However, like in classical case, quan- 
tum signals are vulnerable to noise or decoherence. For 
long-distance QKD, therefore, it is desired that quantum 
signals be amplified in the intermediate locations in the 
channel. However, due to the no-cloning theorem [11-13] , 
the task cannot be done in such a simple manner. For- 
tunately, however, quantum signals can be transported 
even under noisy environments to a remote site by quan- 
tum repeaters [14]. However, it is difficult to realize the 
quantum repeaters with current technologies. Therefore, 
we nccd to rclax the distance-limit in QKD without quan- 
tum repeaters. One of the most promising candidate for 
this is to use surface-to-satellite free-space BB84 QKD 
[15-18]. However, the surface-to-satellite scheme would 
suffer high loss. High loss is a serious threat to the BB84 
protocol, due to photon number splitting (PNS) attack 
[19-23]. Thus there have been a study [21] and a proposal 
[24] on how to overcome the PNS attack. 

The purpose of this paper is to propose decoy-state 
method to overcome the PNS attack for BB84 protocol 
in the presence of high loss. This paper is organizcd 
as follows. First we will briefly review how PNS attack 
renders the BB 84 protocol with high loss insecure. Next 



we decribe the decoy-state method. Next we argue why 
we can assume that the loss of decoy-states is similar to 
that of other signal pulses. Then we derive a condition 
for security of the proposed protocol. Finally we discuss 
and conclude. 

Let us briefly describe the PNS attack [19-23]. Un- 
less perfect single-photon sources are used, BB84 proto- 
col with loss is vulnerable to the following attack of Eve 
(an eavesdropper). Let us assume that Alice (one legit- 
imate participant) uses the following photon sources in 
BB84 protocol [2]. Emits a pulse that contains a single- 
photon with, for example, 90 % probability, and emits 
a pulse that contains multi-photons with 10 % probabil- 
ity. The problem here is that multi-photons are inad- 
vertantly generated and thus we do not know when they 
have been emitted. Also assume that the channel loss 
l is, for example, 90 %, or it has 10 % yield y. Here 
y = 1 — l and y corresponds to p exp in Ref. [23]. Here 
we assume that Bob (the other legitimate participant) 
uses more practical detectors that are insensitive to pho- 
ton numbers. A more rigorous definition of the yield will 
be given later. Eve's attacking method is the followings. 
First, Eve measures the number of photons of each pulse. 
When it is one, she just blocks it. When it is more than 
one, she splits the photons. (Our discussion here is vàlid 
for general photon sources because "Alice can dephase 
the states to create a mixture of Fock states [22,23]", as 
described later.) Then she preserves one and sends the 
other photons via an ideal lossless channel to Bob. As 
usual, we assume that Eve has unlimited technological 
and computational power. She is only limited by laws 
of Nature. Then what Bob observes is that only 10 % 
of photon pulses arrive at him, as expected. However, 
Eve can get full information about the key by measuring 
each of the preserved photons in a proper basis that is 
publically announced later by Alice. We adopt the best 
case assumption for Eve as usual, that all multi-photon 
pulses were used for the PNS attacks. Then we can see 
that if the yield y is less than the probability p mu iu of 
multi-photon generations then the scheme is totally in- 
secure due to the PNS attacks. In other words, yield 
y must be greater than the probability p mu iu of multi- 
photon generations in order that the scheme be secure 
[23], 



y > Pmulti- 



(1) 



Here the probability p mu iti of multi-photon generations 
is a parameter for quality of (imperfect) single-photon 
sources. The smaller it is, the higher the quality is. For 
a single-photon source with a given quality, the loss that 
can be tolerated is determined by Eq. (1). 
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Therefore, when yield y is very low, almost perfect sin- 
gle photon generator is required [22,23]. This fact mo- 
tivated current developements of single-photon sources 
and demonstration of QKD with thcm [25]. However, 
the problem is that the sources cannot be perfect singlc- 
photons in practice [26] . In the case of surface-to-surfacc 
free-space BB84 protocol, this condition seems to bc 
barely satisfied [16]. However, the loss in surface-to- 
satellite scheme must be higher than that in the surface- 
to-surface scheme, because in the former case one party 
is moving fast and more far apart. Moreover, security 
of surface-to-satellite protocol in which a satellitc plays 
a role of a legimate user is based on physical security of 
the satellite. That is, we must assume that Eve cannot 
secretly observe inside of the satellite. However, it is not 
easy to justify the assumption. Thus we propose to usc 
(possibly geostationary) satellite with mirrors that con- 
nect users on the surface. (The refection-protocol has 
been proposed in the context of multi-users QKD [18].) 
In this casc, it is clear that the loss will be much higher. 
This means that it is difficult to implcment secure scheme 
with current technologies. 

Thus we need methods to directly detect the PNS at- 
tack. One possibility is to monitor photon-number statis- 
tics that might have been disturbed by Eve's PNS attack. 
This possibility has been studicd in the case of weak co- 
herent states [21]; Simple minded PNS attack disturbs 
the photon-number statistics of the pulses thus it can be 
detected by Bob. However, Eve can launch a sophis- 
ticated PNS attack that preserves the photon-number 
statistics [21]. Thus we need another method against 
the PNS attack. 

The bàsic idea of the decoy-state method is the follow- 
ings. In PNS attack, Eve selectively transports subsets 
of multi-photons to Bob. Thus the yield of multi-photon 
pulses must be abnormally higher than that of singlo pho- 
ton pulses. Let us assume that Alice had intentionally 
and randomly replaces photon pulses from signal sources 
by multi-photon pulses (the decoy states). Since Eve 
cannot distinguish multi-photon pulses of signal source 
from those of decoy source, the yields of the two pulses 
must be similar. Thus Alice and Bob can detect the PNS 
attack by checking the yield of decoy source. 

Bcfore we give the decoy-state method, let us dc- 
scribe preliminaries more precisely. Let us consider a 
source that emitts a pulse |n) that contains n photons 
(in the same polarization state) with a probabity p n . 
Here n = 0, 1, 2, ... and J2 n P n = 1- Each pulse is used 
to encode one bit of key. Let us also consider a source 
that generates a coherent state \\ie ) [22-24]. By ran- 
domizing the phase 6, the state reduces to a mixed state 
p = j {d9 /2·n)\l·ié l0 ){iié l6 \. However, this state is equiva- 
lent to mixture of Fock state ^ n P n (/j,)\n)(n\, with Pois- 
sonian distribution P n {y) = e~ M ^™ jn\. In other words, 
the source that emits pulses in coherent states \/J,e l9 ) is, 
after phase randomization, equivalent to a source that 
emits an n-photon state \n) with a probability P n (n). 

Alice adopts two photon sources, that is, singal source 



S and decoy source 5". Signal source is used to dis- 
tribute key. Decoy source is used to detect the PNS at- 
tack. Let us first consider the most practical case where 
both sources are generators of coherent states. For signal 
source S, we adopt \x < 1, that is, it mostly emitts single- 
photon pulses. For decoy source S", we adopt // > 1, that 
is, it mostly emitts multi-photon pulses. The polariza- 
tion of the pulses of the decoy source is randomized such 
that it cannot be distingushied from those of the signal 
source as long as photon numbers of the pulses are the 
same. 

We assume that Bob uses practical photon detectors 
that are insensitive to photon numbers. The yield y n and 
y' n are relative freqüències that n-photon pulses from the 
signal and decoy sources are registered by Bob's detector, 
respectively. Here < y n ,y' n < 1- It is notable that the 
yields can be unity even if some photons in a pulse are 
lost. It is because Bob's detector does not count number 
of 'lost photons' in a pulse that is detected. Yield of 
signal source Y s and that of the decoy source Yd are, 
respectively, given by 

Y s = J2 PnMVn, Y d = J2 P MVn- (2) 

n n 

Here Y s and Yd can be directly detected by Bob. We also 
consider yield of only multi-photon pulses from singal 
source, Y™, that is given by, 

oo 

YT = Y,Pn{tiVn. (3) 

n=2 

This quantity cannot be directly measured but it can 
be bounded based on other yields. Normalized yield of 
multi-photon pulses from singal source, Y™, is given by, 

oo oo 

ír-E^wE^)- ( 4 ) 

n=2 n=2 

Now let us describe the protocol more precisely. In the 
decoy-state method, Alice performs BB84 protocol with 
signal source S. However, Alice randomly replaces the 
signal source S by the decoy source S' with a probability 
a. After Bob announces that he has received all photon 
pulses, Alice announces which pulses are from the de- 
coy source. By públic discussion, they estimate the total 
yield of signal source Y s and that of decoy source Yd- If 
Yd is too larger than Y s , they abort the whole protocol. 
Otherwise, they continue the protocol by estimating yield 
of multi-photon pulses from singal source, Y™ , using the 
yield of decoy source Yd in the following way. 

Eve cannot distinguish multi-photon pulses of singal 
source from those of decoy source. Thus we can expect 
that the normalized yield of multi-photon pulses from 
signal source is similar to that of decoy source that mainly 
composes of multi-photon pulses. Let us discuss it in 
more detail. First, we can see that the yields y n and y' n 
cannot be different. That is, 



2 



Vn = Vn- 



(5) 



It is because, for a given pulse with a certain photon 
number, Eve can get no more information about which 
source the pulse is from, than what she obtains from the 
Bayes's law. The only way for Eve to take advantage of 
the Bayes's law is to control vàlues of y n as she like. 
From Eqs. (2) and (5), it is easy to obtain 



J2W)Vn <Y d . 



(6) 



n=2 



Now the problem is how F s m = Y^=2 Pni^ï/n is bounded 
by Eq. (6). Eve's goal is to make Y™ as large as possible, 
for a givcn yield of decoy source Yd- In othcr words, it 
is to make the ratio A = E^L 2 Pn(p)y n / EÍT=2 Pn{^')Vn 
as large as possible. Let us now note that, for fi < fi' as 
we will choose, 



> 



if n < m. 

P n {fi)/P n {fi') 
[e-Ve^'][WM') n ] 



It is because 

[e-"/i n /"!]/[e-' , V)7n ! ] 
can see that the ratio A is bounded as, 

a _ En=2 P™ 

YZUW)vn - W) 



(7) 



We 
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It is because P2(fi)/P2(fi') 

A = [l/{P 2 (/i') J2n=2 W)UHW En=2 W)ï/ n - 
[l/{ W) En= 2 Pn(n')Vn}} En=2 VM^M " 

P2(fJ>')Pn(tJ>)} > 0. Here we have used Eq. (7) and 
yn,Pn > 0. The equality is achieved when t/2 > and 
yi = 0, where i = 3, 4, 5, ... . 

Thus this is Eve's best choice. This can be interpreted 
as follows. The larger the number of photons of a given 
pulse is, the more probable it is that the pulse is from 
the decoy source, by the Bayes's law and the property of 
the Poissonian distribution. Eve had better not to make 
Bob's detector register when it is more probable that the 
pulse is from the decoy source. Thus Eve's optimal choice 
is to block pulses containing more than 2 photons. 

By Eqs. (3), (6) and (8), we can get 



ym < 



W) 



Y d . 



The normalized one, Y™, is given by, 

i w 



yra < 



W)E~2^(M) 



Y d . 



(9) 



(10) 



/-^(aO and í^Ím)/ Y^=2 Pnifj) are 01 orders of unity in 
reasonable regions of /x and fi' , for example, fj, = 0.5 and 
/i' = 1 . Thus we get the expected result that F s m and Yd 
have the same order of magnitudes. 



The condition for security in Eq. (1) expresses 
the following. In order that the protocol be secure, 
the total number of pulses that are detected must be 
greater than that of attacked ones. In the case of the 
decoy-state method, the number of attacked pulses is 
E^L 2 Pn(p-)]Y" 1 - Thus the condition reduces to 



Y K > 



max{[]TP„( M )]Yr}, 



(11) 



n=2 



where the maximun is taken all strategies by Eve. From 
Eqs. (10) and (11), we obtain a condition for security 



Y s > 



Y,. 



(12) 



Let us roughly estimate the quantities in our case where 
both signal and decoy sources are generators of coher- 
ent states with Poissonian statistics P n {n) and P n {l· 1 ') of 
photon numbers n, respectively. In normal operations 
of the protocol, that is, when Eve does not disturb the 
communication, Yd will be larger than Y s by a factor of 
fi'/l-b. Then the condition reduces to 



P 2 (M) li' = 
P 2 (n') fi fi' 



< 1. 



(13) 



For a given //, Eq. (13) is satisfied when fi is small 
enough, because n/e^ < fi. For example, when fi = 0.3 
and /i' = 1.0 the lcfthand-sidc of Eq. (13) is around 
0.604. 

One might say that the mean photon number of signal 
source, fi, should still be quite smaller than unity even 
with decoy-state method and thus there is no improve- 
ment over usual protocols without decoy-state method. 
However, this is not the case: Eq. (13) does not contain 
a term that amounts to channel loss, in contrast with 
the casc of Eq. (1). Thus the condition for security can 
be satisfied no matter how high the loss is in the normal 
opertations. 

Our analysis above can be generalized to sources with 
any probability distribution p n . For example, let us 
consider almost perfect single photon generator with a 
particular photon number distribution pi = 1 — e and 
Pi = k/i\ where e C 1, fc is a certain constant satisfying 
^™ 2 p, = e, and i = 2,3,... . Using the same decoy 
source 5', the condition for security in this case is 



Y s > 



W) 



Y d . 



(14) 



Eq. (14) is satisfied by a large margin when e is small 
enough. However, key generation rate would be propor- 
tional to the margin. Thus, key generation rate can be 
larger than that of the case where weak-coherent-states 
are used as signal source. 

In general, the more similar forms the photon-number 
statistics of the signal source and decoy source have in 
a region of multi-photons, the more efficient the decoy- 
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state method is. Let us also consider the following ex- 
treme case. Consider an almost-perfect single-photon 
generator with a photon number distribution, p\ = 1 — e 
and pn = e, whcrc í«1 and N is a number quite larger 
than 2, for examplc, 10. In this case, Eve selectively at- 
tacks the N photon pulses, making it more difficult to 
satisfy the corresponding security condition, if wc adopt 
the same decoy source S' with Poissonian distribution 
P(fi'). Thus a general stategy in a design of a pair of sig- 
nal and decoy sources is to make the forms of the photon 
number statistics of the two sources as similar as possible, 
in the region of multi-photons. 

The proposed method is based on the bàsic idea of ran- 
dom sampling. Thus we believe that the security of the 
proposed protocol against the most general attacks can 
be shown later, possibly extending methods developed in 
recent literatures [27-29]. 

Conditions for security of protocols with more practical 
settings, e.g. non-zero dark count rate and misalignmcnt 
of basis, should also be analyzed later. 

The only way to address certain imperfection so far is 
to assume the best-case for Eve [27-29]. For non-zero er- 
ror rates, for example, we assume that it is entirely due to 
Eve's attack. Decoy-state method, however, is an exam- 
ple where we can relax this kind of assumptions without 
loss security in a proper way. It will be worthwhile to look 
for similar ideas that can address other imperfections. 

In conclusion, we have proposed a decoy-state method 
to overcome the photon-number-splitting attack for 
BB84 QKD protocol in the presence of high loss: A legit- 
imate user intentionally and randomly replaces the signal 
pulses by multi-photon pulses (the decoy states). Then 
they check the yield of the decoy-states. If the yicld of 
the decoy-states is abnormally higher than that of other 
signal pulses, the whole protocol is aborted. Otherwisc, 
to continue the protocol, they estimate yield of signal 
multi-photon pulses based on that of decoy-states. This 
estimation can be done with an assumption that the two 
losses have similar vàlues, that we justified. We have 
demonstrated that the estimation can be made indeed 
in the pratical case of coherent pulses sources. However, 
the analysis can be generalized to arbitrary case. 
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